EUVD-2026-19812Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group remove control and family editor state/country. This is primarily an admin-to-admin stored XSS path when writable entity fields are abused. This vulnerability is fixed in 7.1.1.
AnalysisAI
Stored XSS in ChurchCRM prior to 7.1.1 allows authenticated administrators to inject malicious scripts via group remove controls and family editor state/country fields. The vulnerability requires high-privilege account access and user interaction to trigger, making it an admin-to-admin attack surface rather than a direct threat to end-users. ChurchCRM 7.1.1 and later contain the fix.
Technical ContextAI
ChurchCRM is an open-source church management system built on web technologies. The vulnerability stems from improper input validation and output encoding in HTML contexts, specifically in two administrative UI components: the group remove control and family editor form fields for state/country. CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting) indicates that user-supplied data from writable entity fields is rendered back into the page without adequate HTML escaping or Content Security Policy protections. The attack surface is limited to authenticated administrator accounts with write permissions to these specific entity attributes, reducing exposure compared to unauthenticated XSS vulnerabilities.
RemediationAI
Upgrade ChurchCRM to version 7.1.1 or later to apply the vendor-released patch. Organizations unable to upgrade immediately should restrict administrative access to users with a demonstrated need for entity editing functionality, and consider implementing network-level controls to limit exposure of the ChurchCRM administrative interface. Monitor audit logs for unusual administrative activity, particularly modifications to group and family entity fields. See https://github.com/ChurchCRM/CRM/security/advisories/GHSA-44j4-jjw2-wcr6 for additional mitigation guidance from the vendor.
The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP c
The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data. Rated medium severity (CVSS 6.1), this vulner
ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-
Remote code execution in ChurchCRM before 7.4.0 lets an authenticated administrator run arbitrary PHP on the server by i
Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path trav
ChurchCRM church management system versions before 7.1.0 allow authenticated users with EditSelf permission to exfiltrat
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with low privileges to execute arbitrary S
Stored cross-site scripting in ChurchCRM versions prior to 7.0.0 allows authenticated users to inject malicious JavaScri
Insecure Direct Object Reference (IDOR) in ChurchCRM API allows authenticated low-privilege users to manipulate arbitrar
Stored Cross-Site Scripting in ChurchCRM admin panel enables session hijacking and administrative account takeover throu
Insecure Direct Object Reference in ChurchCRM before 7.4.0 lets an authenticated non-admin user with EditSelf access rea
Server-Side Request Forgery in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to trigger outbound
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today